Date: Mon, 5 Jan 2015 09:56:24 -0800 From: Korvin Szanto <Korvin@...tlandlabs.com> To: Henri Salo <henri@...v.fi> Cc: oss-security@...ts.openwall.com, cve-assign@...re.org, abuse@...crete5.org, security@...crete5.org, Simo Ben youssef <simo@...xploit.com> Subject: Re: CVE request: Concrete5 XSS vulnerability This has been fixed in 5.7.3 for some time https://github.com/concrete5/concrete5-5.7.0/commit/e3d47d2af88ddef36deaf754ef22f1f39b9b623b We have a security disclosure program for this so any disclosure outside of our program is very irresponsible and unprofessional. You end up with outdated information and leave us unable to fix the issue in a secure way since we cannot see it until it's brought to our attention through our disclosure program. On Fri, Jan 2, 2015 at 11:43 AM, Henri Salo <henri@...v.fi> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Can you assign CVE identifier for following vulnerability in Concrete5, thanks. > > http://seclists.org/bugtraq/2014/Dec/53 > http://osvdb.org/115633 > http://osvdb.org/115634 > > ps. there is something wrong with http://www.openwall.com/lists/oss-security/ it > says "an error occurred while processing this directive" > > - -- > Henri Salo > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.12 (GNU/Linux) > > iEYEARECAAYFAlSm9P4ACgkQXf6hBi6kbk+bfQCgjF/EWeO4Wfs0SUSsq96LwNpE > AWAAn1yKEw9eDAlJ6cQczjzHZ7VGdXUp > =0mVH > -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ